Bug 2220290

I traced this back to a test suite failure triggered by a deprecation warning in pyOpenSSL. I created an upstream issue: https://github.com/pyca/pyopenssl/issues/1228

=================================== FAILURES ===================================
____________________ ComparableX509Test.test_getattr_proxy _____________________

self = <util_test.ComparableX509Test testMethod=test_getattr_proxy>

    def test_getattr_proxy(self):
>       self.assertIs(self.cert1.has_expired(), True)

tests/util_test.py:22: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <OpenSSL.crypto.X509 object at 0x7f57096df2c0>

    def has_expired(self) -> bool:
        """
        Check whether the certificate has expired.
    
        :return: ``True`` if the certificate has expired, ``False`` otherwise.
        :rtype: bool
        """
        time_bytes = self.get_notAfter()
        if time_bytes is None:
            raise ValueError("Unable to determine notAfter")
        time_string = time_bytes.decode("utf-8")
        not_after = datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
    
>       return not_after < datetime.datetime.utcnow()
E       DeprecationWarning: datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.now(datetime.UTC).

/usr/lib/python3.12/site-packages/OpenSSL/crypto.py:1437: DeprecationWarning
=========================== short test summary info ============================
FAILED tests/util_test.py::ComparableX509Test::test_getattr_proxy - Deprecati...
======================== 1 failed, 193 passed in 0.51s =========================

Running the tests with:

  %pytest -Wdefault

Usually helps.

That is a good idea. I added that to the spec file and triggered a new build.

Additionally I submitted a PR for pyOpenSSL upstream: https://github.com/pyca/pyopenssl/pull/1229

Btw: I won't have time to take care of the rest of the certbot stack so I'd be glad if someone else could trigger rebuilds for certbot.